MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99d0eb6047cc8c9f8cd061a6fcd18bb1fb6a5d4cfb78dd626b7f90a2d90e11b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RemcosRAT

Vendor detections: 13

Intelligence 13 IOCs YARA 25 File information Comments

SHA256 hash:	99d0eb6047cc8c9f8cd061a6fcd18bb1fb6a5d4cfb78dd626b7f90a2d90e11b2
SHA3-384 hash:	0d036830421c1d21a4b818589e1e0d8fb129857d5d89d508d82292640c50fa21a0fb9ceec17138011e58707701b1563b
SHA1 hash:	9ce499ab1fb412e7934e7e720c74c2476624b0d5
MD5 hash:	d1750b22a4bbfeafbfc0811a31439500
humanhash:	harry-mirror-romeo-gee
File name:	loader_8e7c4479c8530a2b.ps1
Download:	download sample
Signature	RemcosRAT Create hunting rule
File size:	308'942 bytes
First seen:	2026-07-14 15:33:50 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	6144:M4H4QjBpKk6GOYqntG7dgkbwhsMvvBAeU+4Vt6csRD:54GBpK1nrtozqXBe4
Threatray	4 similar samples on MalwareBazaar
TLSH	T14464F0B6C67428760E9C1368105D3FF3ADFC9DCF846874A4844CA4DEB4A47E2AD6C2E5
Magika	powershell
Reporter	VuThienDinh
Tags:	ps1 remcos RemcosRAT

VuThienDinh

RemcosRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a56603cb3055706bb5541d2

Tags:

downloader dropper virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug base64 base64 ctfmon.exe dropper hacktool mimikatz obfuscated obfuscated packed remcos

Link:

https://www.filescan.io/uploads/6a566035a241fbac8598a465/reports/3b3b9d15-8c23-48cf-a3bd-1b6d55630e61/overview

Verdict:

Malicious

Labled as:

Trojan.PS.Agent

Link:

https://www.hybrid-analysis.com/sample/99d0eb6047cc8c9f8cd061a6fcd18bb1fb6a5d4cfb78dd626b7f90a2d90e11b2

Verdict:

Malicious

File Type:

ps1

First seen:

2026-07-14T13:19:00Z UTC

Last seen:

2026-07-14T23:59:00Z UTC

Hits:

~10

Detections:

HEUR:Backdoor.Win32.Remcos.gen Backdoor.Win32.Remcos.sb

Link:

https://opentip.kaspersky.com/99d0eb6047cc8c9f8cd061a6fcd18bb1fb6a5d4cfb78dd626b7f90a2d90e11b2/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/99d0eb6047cc8c9f8cd061a6fcd18bb1fb6a5d4cfb78dd626b7f90a2d90e11b2

Verdict:

Malware

YARA:

2 match(es)

Tags:

Base64 Block Base64 Payload Contains Base64 Block DeObfuscated Executable PE (Portable Executable) PE File Layout PowerShell T1027 T1059.001

Link:

https://app.malva.re/file/d1750b22a4bbfeafbfc0811a31439500

Detection:

remcos

Link:

https://mwdb.cert.pl/sample/99d0eb6047cc8c9f8cd061a6fcd18bb1fb6a5d4cfb78dd626b7f90a2d90e11b2/

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2026-07-14 15:51:22 UTC

File Type:

Text

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=thiowychzsgj7dgqmgtpzumlwh5wuxkm7n4n2ytlp6ikfwiocgza._file

Verdict:

suspicious

Label(s):

remcos

RemcosRAT

99d0eb6047cc8c9f8cd061a6fcd18bb1fb6a5d4cfb78dd626b7f90a2d90e11b2

RemcosRAT

error

RemcosRAT

Result

Malware family:

remcos

Score:

10/10

Tags:

family:remcos botnet:remotehost discovery execution rat upx

Link:

https://tria.ge/reports/260714-tpem4aay4s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

UPX packed file

Executes dropped EXE

Family: Remcos

Malware Config

C2 Extraction:

oudwaubach.nl:443

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/99d0eb6047cc8c9f8cd061a6fcd18bb1fb6a5d4cfb78dd626b7f90a2d90e11b2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	Invoke_Mimikatz Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Invoke-Mimikatz String
Reference:	https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Remcos Create hunting rule
Author:	kevoreilly
Description:	Remcos Payload

Rule name:	REMCOS_RAT_variants Create hunting rule

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_3 Create hunting rule
Author:	Kevin Falcoz
Description:	UPX 3.X

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Trojan_Remcos_921ef449 Create hunting rule
Author:	Elastic Security

Rule name:	win_remcos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.remcos.

Rule name:	win_remcos_rat_unpacked Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	win_remcos_w0 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.

Rule name:	yarahub_win_remcos_rat_unpacked_aug_2023 Create hunting rule
Author:	Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

ps1 99d0eb6047cc8c9f8cd061a6fcd18bb1fb6a5d4cfb78dd626b7f90a2d90e11b2

(this sample)

Link

https://tria.ge/260714-sg2xzshz4w

Delivery method

Distributed via e-mail attachment

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample